Proxmox and Sophos: Why I Eventually Want to Separate My Firewall
My homelab is becoming more extensive. Where I initially focused mainly on separate systems, I have increasingly started looking at how everything works together.
Two components that have become important in this process are Proxmox and Sophos.
Proxmox runs on my server ANNA. My Sophos firewall also runs within Proxmox as a virtual machine.
This setup has served me well over the past few years. But I have now reached a point where I would prefer to separate my firewall from Proxmox.
First, a Quick Look at Proxmox
If you are not yet familiar with Proxmox, I have written a blog post about it:
What Is Proxmox and Why Do I Use It in My Homelab?
There, I explain what Proxmox does and why I use it on ANNA.
In this article, I want to focus on how it works together with Sophos and why I am now looking at this setup differently.
ANNA as the Foundation
ANNA is my Dell R415 server and forms an important part of the foundation of my homelab.
Proxmox runs on ANNA. From within Proxmox, I can run various virtual machines and containers.
One of those virtual machines is Sophos.
This was a great solution for me. I did not need a separate computer for my firewall, and I could simply run Sophos within Proxmox.
It was ideal for building my homelab.
Using the hardware I already had, I could learn a great deal, test things and experiment.
Sophos Runs as a Virtual Machine
My Sophos firewall does not run on a separate physical firewall computer.
Instead, it runs as a virtual machine within Proxmox on ANNA.
Proxmox provides the virtualisation, while Sophos performs the firewall functions inside that virtual machine.
This allows my different networks and systems to communicate through Sophos where necessary. At the same time, I can control which traffic is allowed and which traffic is blocked.
For me, this was a good way to build my homelab without immediately having to buy lots of additional hardware.
Why I Want to Change This Now
Eventually, I want to move away from this setup.
Not because Sophos running on Proxmox does not work. In fact, it has worked very well for a long time.
But my homelab is growing, and I would like to make my firewall independent of ANNA.
At the moment, Proxmox and my firewall depend on the same physical server.
If I need to work on ANNA or Proxmox, that also affects my firewall.
I find that increasingly inconvenient.
That is why I am now looking for a separate, suitable machine for my firewall.
Looking for a Better Machine
I do not want to buy a new computer simply for the sake of it.
Instead, I am looking for a machine that fits what I want to do with my firewall.
The firewall should be able to run independently, without depending on the Proxmox server.
This would give my homelab a clearer separation of responsibilities.
ANNA could then focus on Proxmox, virtual machines and containers.
The firewall would have its own machine and could focus entirely on the network and its security.
For me, this is a logical next step in the development of my homelab.
Not Everything Has to Be Perfect Straight Away
I think it is important to be honest about this.
My homelab was not built according to a perfectly planned design from the beginning.
I started with the hardware I had. From there, I continued building, testing and learning.
Running Sophos as a virtual machine on Proxmox was a perfectly good solution at the time.
Now that my environment is growing, my requirements are changing too.
Sometimes that means revisiting an earlier decision and doing things differently.
I do not mind that at all.
It is precisely through this process that you learn.
This Is Not a Story Written from Behind a Desk
My life changed after a stroke. During my recovery, I have gradually started picking up my technical hobby again, one step at a time.
That is why I do not write on this website as though I were a professional IT specialist telling everyone how things should be done.
I write about what I use myself, what I research and what I learn along the way.
Sometimes something works straight away.
Sometimes I make a mistake.
And sometimes I discover that a solution that worked well at first no longer fits what I want to achieve.
That is exactly what is happening with my firewall now.
I deliberately chose to run Sophos virtually on Proxmox in the first place. Now I want to explore whether a separate machine would be a better fit for my situation.
That is not a failure. It is simply the next step.
Moving Forward One Step at a Time
For me, my homelab is more than just a collection of computers and networking equipment.
It is also a way to keep doing something I enjoy during my recovery.
That is why I try not to change everything at once.
I focus on one component, try to understand what is happening, and then move on to the next step.
My next step is clear:
Find a suitable machine on which my firewall can run independently.
After that, ANNA can focus entirely on Proxmox, virtual machines and containers again.
My homelab is far from finished.
But that is perfectly fine.
I will continue building Wim’s Digital Playground one step at a time.
Do you have experience running a separate firewall machine in a homelab? What would you look for when choosing such a machine? Feel free to leave a comment. I would love to hear about your experiences.